wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function

Description

There is a cross-site scripting (XSS) issue in wangEditor via the image upload function in version 4.7.11. This issue has been fixed in version 4.7.12.

Recommendation

Update the @wangeditor/editor package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.7.11
• Patched version(s): 4.7.12

References

• GHSA-9hfw-cvf4-5x25
• CVE-2022-25037
• CAPEC-310
• OWASP 2021-A6

Related Issues

• @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details - CVE-2022-39350
• Reflected cross-site scripting (XSS) vulnerability - CVE-2022-0087
• Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
• Decap CMS Cross Site Scripting (XSS) vulnerability - CVE-2025-57520

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

@wangeditor/editor